CVE-2026-116725
gbsplay through 0.0.103 Out-of-Bounds Read via mapper_map ROM Bank Index
CVSS Score
5.5
EPSS Score
0.0%
EPSS Percentile
0th
gbsplay through 0.0.103 contains an out-of-bounds read vulnerability in mapper_map() in mapper.c that fails to reject ROM bank indexes beyond the ROM size, causing an underflowed bank length. Attackers can supply crafted .gbr, .gbs or .gb files with malicious bank indexes to make bank_get() read far past the heap ROM buffer and crash the player.
| CWE | CWE-125 |
| Vendor | mmitch |
| Product | gbsplay |
| Published | Oct 26, 2026 |
Stay Ahead of the Next One
Get instant alerts for mmitch gbsplay
Be the first to know when new medium vulnerabilities affecting mmitch gbsplay are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected Versions
mmitch / gbsplay
0 ≤ 0.0.103
References
github.com: https://github.com/mmitch/gbsplay/issues/201 github.com: https://github.com/mmitch/gbsplay github.com: https://github.com/mmitch/gbsplay/commit/a281d80bc56ed63347daf740a2f7aa4f8516165a github.com: https://github.com/mmitch/gbsplay/blob/0.0.103/mapper.c#L71-L103 hackmd.io: https://hackmd.io/@haindpwn/gbsplay-rom-bank-index-oob-read vulncheck.com: https://www.vulncheck.com/advisories/gbsplay-through-0.0.103-out-of-bounds-read-via-mapper-map-rom-bank-index
Credits
HaiND from the Post and Telecommunication Institute of Technology